167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Size

1.9MB
MD5

e398bb2855440f8d72019c7e162a9cbf
SHA1

686ac8b6fccd07404dd437cb199dc1020268b598
SHA256

167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432
SHA512

3c6fcdb2cc8f98cd859248b83ea9d0c49c8570553fe251bd4722954229162ffdd246daac6a92b89a0dee0a34b49305130345a0b586c72494298937be054421ff
SSDEEP

24576:eDSuoeafBITCz5f0Zvnlsodiatj6pP7GnvHrH+OHgbpd:e+jfQwf0ZflNAa16pP7GnvLHU

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qdisp.dll	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\vrbrothers.com\NumberOfSubdomains = "1"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\vrbrothers.com	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine.1"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\HELPDIR	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CurVer	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMRoutine Class"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID\ = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\Version = "1.0"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer\ = "QMDispatch.QMRoutine.1"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\CLSID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\ = "QMDispatch.QMFunction"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMFunction"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\VersionIndependentProgID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\TypeLib	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\FLAGS	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMVBSRoutine Class"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMVBSRoutine Class"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CurVer\ = "QMDispatch.QMVBSRoutine.1"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\qdisp.dll"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32\ = "C:\\Windows\\SysWow64\\qdisp.dll"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID\ = "QMDispatch.QMRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\ = "QMRoutine Class"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine.1"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\Version = "1.0"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMRoutine Class"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\Programmable	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\VersionIndependentProgID\ = "QMDispatch.QMVBSRoutine"	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
960	167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe

C:\Users\Admin\AppData\Local\Temp\167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe
"C:\Users\Admin\AppData\Local\Temp\167fe1b5a47129a4c86f058a413696cbc45a0b8d1464fa89e7ab016774ac8432.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\tyihqti.dll

Filesize
52KB

MD5
e31bda70735525bb3543ad34ab9263f6

SHA1
caa5b9d64bdbfc225ad079fc2134618b51ece9b4

SHA256
337290d0547b109fd1d1316fa84736fffebaa8e8f37c1b121b90ad7160ec4bd5

SHA512
046feb4346dfcff4ea19d9dbd922ca7b022687076ba773fd0c2623835445d6d482f34e4c49502034afbfeb9a341ba2ae6961c2dbcd2add9c6f33826ac8d2818c

Download Submit
\Windows\SysWOW64\qdisp.dll

Filesize
48KB

MD5
38b5f9d76f2a5bae8dd63dd105a59356

SHA1
88ac5ff846edb0cbbb01d95d62a190bd3719ec8a

SHA256
d84af542db615e65d5b9545e802937eeb457ea780b2d77eee72123020f2b0e4c

SHA512
281d9fe3e9443559a077d89e8f7cff9d2c63c2793b91ee7b2d2eddc6d4f904c9af31bc65c49e1a5fbf9f827dc0536d5da06f2aab5dd019776cc02712cb1ca305

Download Submit
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download